This shows how bug bounties are pitifully small and inadequate. Stop thinking that a $10k reward will prevent hackers. Either pay-up for sec experts or be prepared to pay-up through extortion or having your site exploited, and it will cost way more than 10k.
I have to say I think ransomware is one of the most interesting "business" practices. The trustworthiness of the criminals is huge because if they have a track record of providing the decryption key, you may as well pay.<p>In a logical extreme you could start adding features like "Give us the info of people you know and for every one we successfully extract a ransom from we'll give you 10% off your ransom."<p>It's interesting to think about at least.
You really can't blame them much, they had backups. University doesn't work like corporate, you have thousands of student who change every year, do their projects for which they require lot of access; you can't lock everything dangerous, can't have any sensible BYOD policy, ... It's really hard to lock up everything while not limiting students too much. With organization like this, that sort of incidents is unfortunate but inevitable.
What if it were a federal criminal offense to pay ransom?
With long prison sentences for any individual convicted of participating in or having knowledge of a payoff?
And the government was serious about tracking down and prosecuting anyone who did so? Nobody would pay ransom, and, at least in countries with such a law, these extortion gangs would stop bothering.
> "The university's cyber insurance policy paid part of the ransom, and the university covered the remainder. No tuition, grant, donation, state or taxpayer funds were used to pay the ransom"<p>I was looking to dunk on them but it seems that what they did wasn’t entirely unreasonable. The article further states that they paid to protect student data.
Out of curiosity, are these hackers still demanding ransom money in Bitcoin, or say any traceable cryptocurrency?<p>I remember encountering similar scenarios before and they all seem to want the money in a Bitcoin address.<p>Why not Monero, or an alternative if there is any, which I guess makes moving the funds around much more stealthily? Please correct me if I'm wrong.
Interesting discussions here about the actual costs and value of finding the bugs that enable these problems. There's basically very little cost to the companies in most cases that have vulnerabilities.<p>It's absolutely crucial, in my opinion, that we pass laws making paying off criminals illegal.<p>There are arguments here that paying off via insurance or other 'secondary means' are somehow shielding the institutions. It's morally wrong, and I suspect in reality it's technically wrong to make these payments. It's just wrong. There is the problem that at least some of these ransomware groups are in countries like Russia that don't care to really prosecute them. We need to stop this, make it clear it's not acceptable, fight with our usual means against money laundering. Pretty much every company company in the western world is vulnerable to these problems, every public school, and behind the scenes lots of people are vulnerable.
When you pay ransom for physical possession you get your possession back.<p>When you pay ransom for lost data you get a copy of your data back. The culprits still have the data, but they likely don't have a use for that data.<p>But this is the worst kind of ransom.<p>You already have the data, you're paying ransom to make sure the culprits don't use the data, but the culprits still are in possession of the data and they can use the data next year, or two years later, or demand more payment next year.<p>What in the world?
Devil's advocate: ransomware is good. The financial incentives around it directly encourage this variety of hacking. It's an involuntary "bug bounty". And IT security becomes something more than a "nice to have" for these institutions, which it never would have before.<p>$450k? Universities know all about paying to learn. That's cheap, and they won't make the same mistakes again.
> "The university's cyber insurance policy paid part of the ransom, and the university covered the remainder. No tuition, grant, donation, state or taxpayer funds were used to pay the ransom," University of Utah officials added.<p>Can anybody elaborate more on this ? What are the other resources than tution/grant/donation/state/fund to earn money ?
At this point the government agency should perform some of those attacks, extort the money, make it public and then delete the data so the victim is out of data and the money.<p>Paying ransoms is terrible for the world. We will have more attacks on more targets. There needs to be heavy incentive to not pay.
There is no way those 450k are not being traced right now like a hell, most likely it was allowed just because investigation said so, its matter of time now